1. for all users on current computer
2. yes
3. yes. stop all that not allowed to startup and prevent startup of if some installaton of "unwanted/not allowed" programs was done.

-> may be also disable/block installation
//is it easy do it if windows connected to win server?